Pulled in security fix from Quassel 1fc8eb59a87c005ddfe7d21bc225bef8692b9743

From the upstream commit:

> ## Make sure that clients can't access buffers belonging to other users ##
> A manipulated, but properly authenticated client was able to retrieve
> the backlog of other users on the same core in some cases by providing
> an appropriate BufferID to the storage engine. Note that proper
> authentication was still required, so exploiting this requires
> malicious users on your core. This commit fixes this issue by ensuring
> that foreign BufferIDs are off-limits.

This applies those same fixes to the MySQL queries.